On Saturday 24 May 2014 16:25:14 Richard W.M. Jones wrote:
What would be nice would be to have an API to just do this
relabelling. Libguestfs could change this API as required to handle
different guests.
Dan Walsh helpfully pointed out to us that we've been doing it wrong
all along :-) A much better way to relabel is to run:
setfiles /etc/selinux/targeted/contexts/files/file_contexts DIR
where 'file_contexts' is a file which contains the default labels for
files (a set of regexps), and 'DIR' is the directory at which
relabelling starts. Note that 'setfiles' would be the libguestfs
appliance binary, so no guest binary needs to be run.
A simple API could just look like this:
guestfs_selinux_relabel (g);
which would always use the 'targeted' policy from the guest, and
always start relabelling at the root. This would work fine for
virt-builder.
For Colin's requirements for Project Atomic, I suspect he will want to
be able to set the file_contexts file and the root directory, but
I'll leave him to describe what would be useful.
I have been experiment/working on this last week (fighting against two
SELinux, the one to make happy in the guest, and the active-but-not-
enforcing one eventually present in the appliance), and now I have
something working.
As you said, there are various possibilities in configuring such
selinux_relabel API; in my first implementation I chose to have it take
as mandatory argument the root of the guest to relabel, and it is able
to discover the configured policy there. Of course I am open to
suggestions/complains/etc about it.
--
Pino Toscano